v0.8.2 ## Added - Limited users API (`GET /api/users/limited`): the activated blue teams with just the fields the scoreboard needs, unauthenticated like the limited checks API - `just setup-node <host> <range>` and `just check-nodes`, which prepare a swarm node's host directories and macvlan config from the manager over ssh, and report which nodes are missing a config network or sharing a range - `HERMES_PUBLIC_IP`, prompted for by `just setup-environment` and used in the traefik host rules ## Changed - The scoreboard builds its team rows from the roster API instead of the live round feed, so teams are listed before the first round lands and stay listed through a round with no results - Round info reads the scores and the ledger separately instead of joining them - Traefik routing split per router: plain HTTP over the public IP, HTTPS with a redirect over the domain, replacing the global entrypoint redirect - `NEXT_PUBLIC_API_URL` is empty in production, so requests go to `/api` on whatever host served the page and one image works at any address - Container registry moved to port 4999 - The traefik swarm provider network is stack-prefixed, matching the name `docker stack deploy` actually creates - `just deploy-prod-swarm` sources `.internal.env` itself and refuses to deploy when the public host variables are unset, rather than deploying green with empty traefik rules ## Fixed - Login behind a TLS-terminating proxy: the session cookie was always marked Secure, so a browser on plain HTTP dropped it with no error anywhere. Login and logout now build the cookie through one constructor, so logout clears what login set - A team with no ledger rows in the current round reported a score of 0 instead of its standing score - The macvlan script takes the IP range as an argument so it can be piped over ssh, removes the two networks in dependency order, and explains what to do when the config network is still in use - `just setup-environment` chowned the hermes path before creating its subdirectories, leaving them root-owned - The `promote_latest` CI job no longer requires the privileged runner tag